Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31681— netfilter: xt_multiport: validate range encoding in checkentry

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xt_multiport中范围编码未在checkentry验证，可能导致越界解析端口数组。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< 8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< c9749f6232c845e31c21d4cc72200211df15d8a2 affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< b67d638cbee9975c765feb45c126e96ed11ec802 affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< 36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16 affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< aec14808271f2bf2b656de6ff12dfe73c5fd3b67 affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< 8368ce8eb01f0b91111d814703696e780d0ef12f affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< 1e4baa853f1cc4227e04f52d6860524707cfb294 affected
a89ecb6a2ef732d04058d87801e2b6bd7e5c7089< ff64c5bfef12461df8450e0f50bb693b5269c720 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31681

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: xt_multiport: validate range encoding in checkentry
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end. The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving ports_match_v1() to step past the last valid ports[] element while interpreting the rule. Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xt_multiport中范围编码未在checkentry验证，可能导致越界解析端口数组。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a89ecb6a2ef732d04058d87801e2b6bd7e5c7089 ~ 8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a -
Linux Linux 2.6.17 -

II. Public POCs for CVE-2026-31681

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31681

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31681 (4)

Same Patch Batch · Linux · 2026-04-25 · 13 CVEs total

CVE-2026-31685 9.4 CRITICAL netfilter: ip6t_eui64: reject invalid MAC header for all packets
CVE-2026-31682 9.1 CRITICAL bridge: br_nd_send: linearize skb before parsing ND options
CVE-2026-31683 7.8 HIGH batman-adv: avoid OGM aggregation when skb tailroom is insufficient
CVE-2026-31680 7.8 HIGH net: ipv6: flowlabel: defer exclusive option free until RCU teardown
CVE-2026-31678 7.8 HIGH openvswitch: defer tunnel netdev_put to RCU release
CVE-2026-31675 7.8 HIGH net/sched: sch_netem: fix out-of-bounds access in packet corruption
CVE-2026-31673 7.8 HIGH af_unix: read UNIX_DIAG_VFS data under unix_state_lock
CVE-2026-31676 7.5 HIGH rxrpc: only handle RESPONSE during service challenge
CVE-2026-31679 7.1 HIGH openvswitch: validate MPLS set/set_masked payload length
CVE-2026-31674 7.1 HIGH netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
CVE-2026-31684 net: sched: act_csum: validate nested VLAN headers
CVE-2026-31677 crypto: af_alg - limit RX SG extraction by receive buffer budget

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31681

No comments yet

Leave a comment